Windows Paint RCE Vulnerability CVE-2026-83844: Analysis and Fix

Vulnerability Overview

Microsoft disclosed a remote code execution (RCE) vulnerability in the Windows Paint application (CVE-2026-83844) with a CVSS score of 7.0 (High). The flaw allows an unauthenticated attacker to read memory outside the intended region and execute arbitrary code locally. The attack is classified as "remote" because an attacker can use social engineering to trick a victim into opening a specially crafted file.

Technical Details

According to Microsoft's October 13, 2026 advisory, the vulnerability stems from an out-of-bounds memory read. Initially, Microsoft rated the severity at CVSS 8.1 due to the potential for network-based malicious code, but later reclassified the attack vector as "Local" because code execution occurs on the local machine after the user opens the malicious file. The CVSS score was adjusted to 7.0.

Affected Versions and Detection

Microsoft initially stated that Paint version 11.2605.91.0 contained the fix, but later corrected this: the vulnerability persists in that version. The patched version is 11.2609.401.0, available in the Paint Insider channel. Users and administrators can verify the installed Paint version by clicking the gear icon in the top-right corner of the Paint window.

Vitko security agency provided two PowerShell commands (run as Administrator) to enumerate Paint installations:

Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } }

Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version

Mitigation and Updates

Users with outdated Paint versions should update via the Microsoft Store (https://apps.microsoft.com/detail/9pcfs5b6t72h?hl=zh-CN). Automatic updates in the Microsoft Store will deliver the fix without manual intervention. The official Microsoft Security Response Center (MSRC) advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844.

Related links: https://apps.microsoft.com/detail/9pcfs5b6t72h?hl=zh-CN https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844